feat(onboarding): artifact ingest + classifier + native tramiton + suite seams (#138)

compliance-core/src/config.rs

@@ -24,6 +24,9 @@ pub struct AgentConfig {
     pub scan_schedule: String,
     pub cve_monitor_schedule: String,
     pub git_clone_base_path: String,
+    /// Base directory for content-addressed artifact blobs and per-run working
+    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
+    pub artifact_store_base_path: String,
     pub ssh_key_path: String,
     pub keycloak_url: Option<String>,
     pub keycloak_realm: Option<String>,

compliance-core/src/models/mod.rs

@@ -33,9 +33,10 @@ pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
 pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
 pub use onboarding::{
-    Artifact, ArtifactAuth, ArtifactKind, Classification, DetectedFact, GitArtifactConfig,
-    IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat, TargetScanConfig,
-    TargetType, TargetTypeCandidate, WebArtifactConfig,
+    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
+    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
+    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
+    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,

compliance-core/src/models/onboarding.rs

@@ -22,7 +22,7 @@ use super::scan::ScanType;
 /// Targets look endlessly varied but fall into a small enumerable set classified
 /// by where the analyzable signal lives. This drives the scan-applicability
 /// matrix and the onboarding wizard's type selection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum TargetType {
     /// Browser-facing web application (front end + server).
@@ -411,6 +411,134 @@ pub struct TargetScanConfig {
     pub issue_tracker: Option<IssueTrackerConfig>,
 }
 
+/// A sibling product in the company suite that may already hold authoritative
+/// data for a target. compliance-scanner reconciles with these rather than
+/// recomputing what they already know.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ExternalSystem {
+    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
+    /// attestation).
+    Tramiton,
+    /// Code assistant (downstream remediation consumer).
+    Werkpilot,
+    /// Compliance-controls RAG (atomic controls derived from laws).
+    BreakpilotCompliance,
+}
+
+impl std::fmt::Display for ExternalSystem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Tramiton => write!(f, "tramiton"),
+            Self::Werkpilot => write!(f, "werkpilot"),
+            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
+        }
+    }
+}
+
+/// A link from this target to a record in a sibling product, used to reconcile
+/// existing evidence instead of recomputing it.
+///
+/// For tramiton, `project_id` is the shared cross-product key and
+/// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
+/// (which equals tramiton's `Artifact.sha256`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExternalRef {
+    /// Which sibling product this reference points at.
+    pub system: ExternalSystem,
+    /// The sibling product's project identifier, if known.
+    pub project_id: Option<String>,
+    /// Content digest of the subject artifact (firmware sha256), if known.
+    pub subject_sha256: Option<String>,
+    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
+    #[serde(default)]
+    pub status: String,
+    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
+    /// `LicenseGrant`), if the tenant provided one.
+    pub license_grant: Option<String>,
+    /// When evidence was last reconciled from this system.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_reconciled_at: Option<DateTime<Utc>>,
+}
+
+impl ExternalRef {
+    /// A freshly linked (not yet reconciled) reference to a sibling system.
+    pub fn linked(system: ExternalSystem) -> Self {
+        Self {
+            system,
+            project_id: None,
+            subject_sha256: None,
+            status: "linked".to_string(),
+            license_grant: None,
+            last_reconciled_at: None,
+        }
+    }
+}
+
+/// A regulatory / standards framework a target must comply with. Drives which
+/// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ComplianceFramework {
+    /// EU Cyber Resilience Act.
+    Cra,
+    /// IEC 62443 (industrial automation & control systems security).
+    Iec62443,
+    /// EU General Data Protection Regulation.
+    Gdpr,
+    /// SOC 2.
+    Soc2,
+    /// ISO/IEC 27001.
+    Iso27001,
+    /// EU Radio Equipment Directive (RED) cybersecurity articles.
+    RedDirective,
+}
+
+impl std::fmt::Display for ComplianceFramework {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Cra => write!(f, "cra"),
+            Self::Iec62443 => write!(f, "iec_62443"),
+            Self::Gdpr => write!(f, "gdpr"),
+            Self::Soc2 => write!(f, "soc2"),
+            Self::Iso27001 => write!(f, "iso_27001"),
+            Self::RedDirective => write!(f, "red_directive"),
+        }
+    }
+}
+
+/// The compliance scope of a target: which frameworks apply and, optionally, the
+/// jurisdiction. Captured at onboarding (with per-target-type defaults from
+/// [`default_compliance_profile`]).
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ComplianceProfile {
+    /// Applicable frameworks.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
+    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
+    pub jurisdiction: Option<String>,
+}
+
+/// The sensible default compliance scope for a target type. Firmware / PLC /
+/// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
+pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
+    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
+    let frameworks = match target_type {
+        TargetType::PlcSps
+        | TargetType::FirmwareBareMetal
+        | TargetType::FirmwareRtos
+        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
+        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
+        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
+            vec![Gdpr, Cra]
+        }
+    };
+    ComplianceProfile {
+        frameworks,
+        jurisdiction: None,
+    }
+}
+
 /// A target onboarded for scanning: the unified replacement for the legacy
 /// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -434,6 +562,12 @@ pub struct OnboardedTarget {
     /// How this target should be scanned.
     #[serde(default)]
     pub scan_config: TargetScanConfig,
+    /// The compliance scope (applicable frameworks / jurisdiction).
+    #[serde(default)]
+    pub compliance_profile: ComplianceProfile,
+    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
+    #[serde(default)]
+    pub external_refs: Vec<ExternalRef>,
     /// Cron schedule for recurring scans, if any.
     pub scan_schedule: Option<String>,
     /// Whether inbound webhooks are enabled for this target.
@@ -472,6 +606,8 @@ impl OnboardedTarget {
             artifacts: Vec::new(),
             classification: None,
             scan_config: TargetScanConfig::default(),
+            compliance_profile: default_compliance_profile(target_type),
+            external_refs: Vec::new(),
             scan_schedule: None,
             webhook_enabled: false,
             webhook_secret: Some(webhook_secret),
@@ -584,4 +720,34 @@ mod tests {
         let b = Artifact::firmware_image("fw.bin");
         assert_ne!(a.id, b.id);
     }
+
+    #[test]
+    fn firmware_default_profile_is_cra_and_62443() {
+        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
+        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
+        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
+    }
+
+    #[test]
+    fn webapp_default_profile_is_gdpr_and_soc2() {
+        let p = default_compliance_profile(TargetType::WebApp);
+        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
+        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
+    }
+
+    #[test]
+    fn new_target_gets_default_profile_and_no_external_refs() {
+        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
+        assert!(!t.compliance_profile.frameworks.is_empty());
+        assert!(t.external_refs.is_empty());
+    }
+
+    #[test]
+    fn external_ref_linked_defaults() {
+        let r = ExternalRef::linked(ExternalSystem::Tramiton);
+        assert_eq!(r.system, ExternalSystem::Tramiton);
+        assert_eq!(r.status, "linked");
+        assert!(r.project_id.is_none());
+        assert!(r.last_reconciled_at.is_none());
+    }
 }

compliance-core/src/traits/controls.rs

@@ -0,0 +1,45 @@
+//! The compliance-controls provider port.
+//!
+//! The mapping engine turns findings into compliance status against a corpus of
+//! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
+//! a tenant-owned RAG of atomic controls derived from laws
+//! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
+//! source so the mapping engine does not hardcode a catalog.
+
+use crate::error::CoreError;
+use crate::models::ComplianceFramework;
+
+/// A control retrieved from a controls corpus.
+#[derive(Debug, Clone)]
+pub struct Control {
+    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
+    pub id: String,
+    /// The framework this control belongs to.
+    pub framework: ComplianceFramework,
+    /// Short human-readable title.
+    pub title: String,
+    /// The control text / requirement.
+    pub text: String,
+    /// Free-form source reference (catalog name, law citation, ...).
+    pub source: Option<String>,
+}
+
+/// A query for relevant controls.
+pub struct ControlQuery<'a> {
+    /// Frameworks in scope for the target.
+    pub frameworks: &'a [ComplianceFramework],
+    /// Free-text describing what to map (a finding summary, a component, ...).
+    pub context: &'a str,
+    /// Maximum number of controls to return.
+    pub limit: usize,
+}
+
+/// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
+#[allow(async_fn_in_trait)]
+pub trait ControlsProvider: Send + Sync {
+    /// Stable identifier for this provider.
+    fn name(&self) -> &str;
+
+    /// Retrieve the controls most relevant to the query.
+    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
+}

compliance-core/src/traits/evidence.rs

@@ -0,0 +1,58 @@
+//! The external-evidence provider port.
+//!
+//! A sibling product (tramiton, for firmware) may already hold authoritative
+//! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
+//! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
+//! reproducible-build lock, an attestation — instead of recomputing it. The key
+//! used to match is the artifact content digest (a firmware sha256, which equals
+//! [`crate::models::Artifact::content_hash`]).
+//!
+//! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
+//! client later) plus a deterministic mock for tests, so nothing here depends on
+//! an external binary.
+
+use std::path::Path;
+
+use crate::error::CoreError;
+use crate::models::{Artifact, ExternalSystem};
+
+/// A single reconcilable evidence document fetched from a sibling product.
+#[derive(Debug, Clone)]
+pub struct EvidenceDocument {
+    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
+    pub kind: String,
+    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
+    pub format: String,
+    /// The raw document payload.
+    pub content: String,
+}
+
+/// The evidence a provider could return for a target's artifact.
+#[derive(Debug, Clone, Default)]
+pub struct ReconciledEvidence {
+    /// The sibling's project identifier, if resolved.
+    pub project_id: Option<String>,
+    /// The subject content digest the evidence pertains to.
+    pub subject_sha256: Option<String>,
+    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
+    pub documents: Vec<EvidenceDocument>,
+}
+
+/// A source of externally-held, reconcilable evidence for an artifact.
+#[allow(async_fn_in_trait)]
+pub trait EvidenceProvider: Send + Sync {
+    /// Which sibling product this provider integrates.
+    fn system(&self) -> ExternalSystem;
+
+    /// Whether this provider can handle the given artifact + working path
+    /// (e.g. tramiton handles firmware images / embedded source trees).
+    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
+
+    /// Reconcile existing evidence for the artifact, keyed by its content digest.
+    /// Returns `Ok(None)` when the provider has nothing for this artifact.
+    async fn reconcile(
+        &self,
+        artifact: &Artifact,
+        working_path: Option<&Path>,
+    ) -> Result<Option<ReconciledEvidence>, CoreError>;
+}

compliance-core/src/traits/mod.rs

@@ -1,12 +1,16 @@
 pub mod classifier;
+pub mod controls;
 pub mod dast_agent;
+pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;
 
 pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
+pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};